[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #382808 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Sunday, August 24, 2025 1:13:47 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #382808 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 382808

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total           Src IP
---------------------------------------------------
  54094200      180314         8.2%   147.28.240.218
  45753600      152512         6.9%   194.180.48.151
  44843700      149479         6.8%   194.180.48.153
  43652700      145509         6.6%   147.28.240.216
  43214700      144049         6.5%   194.180.48.155
  43108200      143694         6.5%   194.180.48.159
  42775800      142586         6.5%   194.180.48.157
  41989500      139965         6.4%   147.28.240.215
  40863900      136213         6.2%   147.28.240.217
  39421200      131404         6.0%   147.28.240.214

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  337955400     1126518        51.2%     132.72.118.23
   16390200       54634         2.5%   192.114.101.113
    6822600       22742         1.0%   128.139.225.244
    3911700       13039         0.6%     216.58.205.42
    3798000       12660         0.6%     216.58.209.42
    3221100       10737         0.5%     13.107.138.10
    2686800        8956         0.4%     132.74.74.134
    2083500        6945         0.3%     82.103.94.190
    2059800        6866         0.3%     128.139.200.4
    2049000        6830         0.3%     128.139.200.5

Top-10 Possible Targets by Bytes:
           Src IP   Src Port            Dst IP   Dst Port   Sampled Count
-----------------------------------------------------------------------
                               192.114.101.113                24580698000
                                 132.72.118.23                14941736400
                                 132.72.118.23        443     14938755000
                               128.139.225.244                 8127736200
                         443   128.139.225.244                 7232055600
  149.165.224.212                                              6639663600
  149.165.224.211      23000                                   5336856000
  149.165.224.211                                   42634      5336856000
  149.165.224.211                                              5336856000
                       23000   192.114.101.113                 5336856000

Metric Info:
3M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate

Start Time: 2025-08-23 22:13:34
End Time: ongoing

First Event Seen: 2025-08-23 22:11:00
Last Event Seen: 2025-08-23 22:12:00

Further Details:
https://primary.nemo.geant.org/alerts/details/382808/